5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28359

CVE-2026-28359: NocoDB: Stored Cross-Site Scripting via Rich Text Field

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28359

CVE-2026-28359:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nocodb	npm	<= 0.301.2	0.301.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Rich Text fields of NocoDB. The root cause of this vulnerability lies in the backend's failure to sanitize user-provided HTML before storing it. The commit c4fcf94c20d6097b2ff6cec1f1aae2caca2c7d0f directly addresses this by introducing server-side sanitization. The analysis of this commit reveals that the CommentsService was responsible for handling the creation and updates of comments, which are a form of rich text. The create and update methods within this service were accepting raw HTML content and persisting it to the database without any sanitization. This allowed an authenticated user with an 'Editor' role to inject malicious scripts. The patch rectifies this by employing DOMPurify to sanitize the content on the server-side before it is stored, thus preventing the stored XSS vulnerability. While the frontend rendering was also made safer by replacing v-html with v-dompurify-html as a defense-in-depth measure, the primary vulnerability was the lack of input sanitization in the backend services.

Vulnerable functions

CommentsService.create

packages/nocodb/src/services/comments.service.ts

The `create` function in `CommentsService` was vulnerable to stored XSS because it did not sanitize the `comment` field from the request body before inserting it into the database. An attacker could provide a malicious HTML payload in the `comment` field, which would be stored raw in the database and executed in the browser of any user viewing the comment. The patch added sanitization using `DOMPurify` to mitigate this.

CommentsService.update

packages/nocodb/src/services/comments.service.ts

The `update` function in `CommentsService` was vulnerable to stored XSS because it did not sanitize the `comment` field from the request body before updating it in the database. An attacker could provide a malicious HTML payload in the `comment` field, which would be stored raw in the database and executed in the browser of any user viewing the comment. The patch added sanitization using `DOMPurify` to mitigate this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.